Creating patch files using git format-patch The patch files that we use to pull in upstream shim changes are not well formatted, and their origin cannot be easily determined without additional context. This new set of patch files has been generated using git format-patch, ensuring that upstream origin is clearly identifiable for each. The Dockerfile is updated to utilize the new patch file names. The patches that get applied have not changed, so binaries produced by a build with them applied should have hashes that match the v9 tag. BUG=b:195737944 TEST=make build-no-cache & make copy Verify that the sha256 hash for shimia32.efi is d7cf7ab01e990fdb2e646434f27807dbc4f0450ccfde622e7a11d3c125a6e0c6 Verify that the sha256 hash for shimx64.efi is 88cd3870afbfc847019b815190d7b1b36d6eb49f3ba8dd8ddee34e09e00d2d60 Change-Id: I9d2c408db7c144e8227fe153cfdc0474084070b4
diff --git a/shim_15.4_8b59591_364.patch b/0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch similarity index 62% rename from shim_15.4_8b59591_364.patch rename to 0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch index aa11591..507fca3 100644 --- a/shim_15.4_8b59591_364.patch +++ b/0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch
@@ -1,5 +1,23 @@ +From 493bd940e5c6e28e673034687de7adef9529efff Mon Sep 17 00:00:00 2001 +From: Peter Jones <pjones@redhat.com> +Date: Sat, 10 Apr 2021 16:05:23 -0400 +Subject: [PATCH] Don't call QueryVariableInfo() on EFI 1.10 machines + +The EFI 1.10 spec (and presumably earlier revisions as well) didn't have +RT->QueryVariableInfo(), and on Chris Murphy's MacBookPro8,2 , that +memory appears to be initialized randomly. + +This patch changes it to not call RT->QueryVariableInfo() if the +EFI_RUNTIME_SERVICES table's major revision is less than two, and +assumes our maximum variable size is 1024 in that case. + +Signed-off-by: Peter Jones <pjones@redhat.com> +--- + mok.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + diff --git a/mok.c b/mok.c -index 9b8fc2bc..beac0ff6 100644 +index 9b8fc2b..beac0ff 100644 --- a/mok.c +++ b/mok.c @@ -261,6 +261,9 @@ static const uint8_t null_sha256[32] = { 0, }; @@ -39,3 +57,6 @@ } /* +-- +2.33.0.309.g3052b89438-goog +
diff --git a/0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch b/0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch new file mode 100644 index 0000000..d047316 --- /dev/null +++ b/0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch
@@ -0,0 +1,41 @@ +From 822d07ad4f07ef66fe447a130e1027c88d02a394 Mon Sep 17 00:00:00 2001 +From: Adam Williamson <awilliam@redhat.com> +Date: Thu, 8 Apr 2021 22:39:02 -0700 +Subject: [PATCH] Fix handling of ignore_db and user_insecure_mode + +In 65be350308783a8ef537246c8ad0545b4e6ad069, import_mok_state() is split +up into a function that manages the whole mok state, and one that +handles the state machine for an individual state variable. +Unfortunately, the code that initializes the global ignore_db and +user_insecure_mode was copied from import_mok_state() into the new +import_one_mok_state() function, and thus re-initializes that state each +time it processes a MoK state variable, before even assessing if that +variable is set. As a result, we never honor either flag, and the +machine owner cannot disable trusting the system firmware's db/dbx +databases or disable validation altogether. + +This patch removes the extra re-initialization, allowing those variables +to be set properly. + +Signed-off-by: Adam Williamson <awilliam@redhat.com> +--- + mok.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/mok.c b/mok.c +index 5ad9072..9e37d6a 100644 +--- a/mok.c ++++ b/mok.c +@@ -888,9 +888,6 @@ EFI_STATUS import_one_mok_state(struct mok_state_variable *v, + EFI_STATUS ret = EFI_SUCCESS; + EFI_STATUS efi_status; + +- user_insecure_mode = 0; +- ignore_db = 0; +- + UINT32 attrs = 0; + BOOLEAN delete = FALSE; + +-- +2.33.0.309.g3052b89438-goog +
diff --git a/0003-Fix-a-broken-file-header-on-ia32.patch b/0003-Fix-a-broken-file-header-on-ia32.patch new file mode 100644 index 0000000..3d3e042 --- /dev/null +++ b/0003-Fix-a-broken-file-header-on-ia32.patch
@@ -0,0 +1,32 @@ +From 5b3ca0d2f7b5f425ba1a14db8ce98b8d95a2f89f Mon Sep 17 00:00:00 2001 +From: Peter Jones <pjones@redhat.com> +Date: Wed, 31 Mar 2021 14:54:52 -0400 +Subject: [PATCH] Fix a broken file header on ia32 + +Commit c6281c6a195edee61185 needs to have included a ". = ALIGN(4096)" +directive before .reloc, but fails to do so. + +As a result, binutils, which does not care about the actual binary +format's constraints in any way, does not enforce the section alignment, +and it will not load. + +Signed-off-by: Peter Jones <pjones@redhat.com> +--- + elf_ia32_efi.lds | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/elf_ia32_efi.lds b/elf_ia32_efi.lds +index 742e0a4..497a3a1 100644 +--- a/elf_ia32_efi.lds ++++ b/elf_ia32_efi.lds +@@ -15,6 +15,7 @@ SECTIONS + *(.gnu.linkonce.t.*) + _etext = .; + } ++ . = ALIGN(4096); + .reloc : + { + *(.reloc) +-- +2.33.0.309.g3052b89438-goog +
diff --git a/0004-mok-allocate-MOK-config-table-as-BootServicesData.patch b/0004-mok-allocate-MOK-config-table-as-BootServicesData.patch new file mode 100644 index 0000000..0ae085b --- /dev/null +++ b/0004-mok-allocate-MOK-config-table-as-BootServicesData.patch
@@ -0,0 +1,39 @@ +From 4068fd42c891ea6ebdec056f461babc6e4048844 Mon Sep 17 00:00:00 2001 +From: Gary Lin <glin@suse.com> +Date: Thu, 8 Apr 2021 16:23:03 +0800 +Subject: [PATCH] mok: allocate MOK config table as BootServicesData + +Linux kernel is picky when reserving the memory for x86 and it only +expects BootServicesData: + +https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/platform/efi/quirks.c?h=v5.11#n254 + +Otherwise, the following error would show during system boot: + +Apr 07 12:31:56.743925 localhost kernel: efi: Failed to lookup EFI memory descriptor for 0x000000003dcf8000 + +Although BootServicesData would be reclaimed after ExitBootService(), +linux kernel reserves MOK config table when it detects the existence of +the table, so it's fine to allocate the table as BootServicesData. + +Signed-off-by: Gary Lin <glin@suse.com> +--- + mok.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mok.c b/mok.c +index 9e37d6a..9b8fc2b 100644 +--- a/mok.c ++++ b/mok.c +@@ -999,7 +999,7 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle) + npages = ALIGN_VALUE(config_sz, PAGE_SIZE) >> EFI_PAGE_SHIFT; + config_table = NULL; + efi_status = gBS->AllocatePages(AllocateAnyPages, +- EfiRuntimeServicesData, ++ EfiBootServicesData, + npages, + (EFI_PHYSICAL_ADDRESS *)&config_table); + if (EFI_ERROR(efi_status) || !config_table) { +-- +2.33.0.309.g3052b89438-goog +
diff --git a/Dockerfile b/Dockerfile index 462b8cb..3040fda 100644 --- a/Dockerfile +++ b/Dockerfile
@@ -24,20 +24,20 @@ # We do not need to support ARM at this time. # https://github.com/rhboot/shim/pull/364 -ADD shim_15.4_8b59591_364.patch . -RUN patch -p1 -i shim_15.4_8b59591_364.patch +ADD 0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch . +RUN patch -p1 -i 0001-Don-t-call-QueryVariableInfo-on-EFI-1.10-machines.patch # https://github.com/rhboot/shim/pull/362 -ADD shim_15.4_975c2fe_362.patch . -RUN patch -p1 -i shim_15.4_975c2fe_362.patch +ADD 0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch . +RUN patch -p1 -i 0002-Fix-handling-of-ignore_db-and-user_insecure_mode.patch # https://github.com/rhboot/shim/pull/357 -ADD shim_15.4_1bea91b_357.patch . -RUN patch -p1 -i shim_15.4_1bea91b_357.patch +ADD 0003-Fix-a-broken-file-header-on-ia32.patch . +RUN patch -p1 -i 0003-Fix-a-broken-file-header-on-ia32.patch # https://github.com/rhboot/shim/pull/361 -ADD shim_15.4_33ca950_361.patch . -RUN patch -p1 -i shim_15.4_33ca950_361.patch +ADD 0004-mok-allocate-MOK-config-table-as-BootServicesData.patch . +RUN patch -p1 -i 0004-mok-allocate-MOK-config-table-as-BootServicesData.patch # Add our public certificate ADD neverware.cer .
diff --git a/shim_15.4_1bea91b_357.patch b/shim_15.4_1bea91b_357.patch deleted file mode 100644 index b5c1672..0000000 --- a/shim_15.4_1bea91b_357.patch +++ /dev/null
@@ -1,12 +0,0 @@ -diff --git a/elf_ia32_efi.lds b/elf_ia32_efi.lds -index 742e0a47a..497a3a152 100644 ---- a/elf_ia32_efi.lds -+++ b/elf_ia32_efi.lds -@@ -15,6 +15,7 @@ SECTIONS - *(.gnu.linkonce.t.*) - _etext = .; - } -+ . = ALIGN(4096); - .reloc : - { - *(.reloc)
diff --git a/shim_15.4_33ca950_361.patch b/shim_15.4_33ca950_361.patch deleted file mode 100644 index baa2f95..0000000 --- a/shim_15.4_33ca950_361.patch +++ /dev/null
@@ -1,13 +0,0 @@ -diff --git a/mok.c b/mok.c -index 5ad9072be..fc1ee04da 100644 ---- a/mok.c -+++ b/mok.c -@@ -1002,7 +1002,7 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle) - npages = ALIGN_VALUE(config_sz, PAGE_SIZE) >> EFI_PAGE_SHIFT; - config_table = NULL; - efi_status = gBS->AllocatePages(AllocateAnyPages, -- EfiRuntimeServicesData, -+ EfiBootServicesData, - npages, - (EFI_PHYSICAL_ADDRESS *)&config_table); - if (EFI_ERROR(efi_status) || !config_table) {
diff --git a/shim_15.4_975c2fe_362.patch b/shim_15.4_975c2fe_362.patch deleted file mode 100644 index 677d1ad..0000000 --- a/shim_15.4_975c2fe_362.patch +++ /dev/null
@@ -1,14 +0,0 @@ -diff --git a/mok.c b/mok.c -index 5ad9072be..9e37d6ab5 100644 ---- a/mok.c -+++ b/mok.c -@@ -888,9 +888,6 @@ EFI_STATUS import_one_mok_state(struct mok_state_variable *v, - EFI_STATUS ret = EFI_SUCCESS; - EFI_STATUS efi_status; - -- user_insecure_mode = 0; -- ignore_db = 0; -- - UINT32 attrs = 0; - BOOLEAN delete = FALSE; -